You can prevent users from using directory browsing by configuring a setting in Group Policy.

You can lock down the setting to enforce disabling directory browsing by using the Outlook Group Policy template (Outlk12.adm). Or you can configure default settings by using the Office Customization Tool, in which case users can change the settings. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

The Outlook template and other ADM files can be downloaded from 2007 Office System Administrative Templates (ADM) on the Microsoft Download Center.

To disallow enabling directory browsing for LDAP by using Group Policy

1. In Group Policy, load the Office Outlook 2007 template (Outlk12.adm).

2. To customize how results are displayed, under User Configuration\Administrative Templates\Microsoft Office Outlook 2007\Miscellaneous, double-click Turn on VLV Browsing on LDAP servers.

3. Click Disabled.

4. Click OK.

In Outlook 2003, directory browsing was enabled by default. However, users must work with small LDAP directories when using directory browsing. A new registry key was provided with Outlook 2003 Service Pack 2 to allow VLV searches to be disabled. Office Outlook 2007 uses the same registry keys to regulate this feature. If your environment uses small LDAP directories and requires directory browsing, you can enable the feature by configuring the option in the Office Customization Tool or by setting the registry key (to make it a default option), or by using Group Policy (to enable and lock down the setting).

If you do not lock down the setting, users can enable or disable the option by using the check box on the Search tab of the Microsoft LDAP Directory dialog box in Outlook.

The existing registry key that managed this LDAP setting in earlier versions of Outlook continues to override server-specific settings that users choose. The registry key is:

	Copy Code
HKCU\Software\Microsoft\Office\12.0\Outlook\LDAP\DisableVLVBrowsing

If this registry key is set to 0, the check box is cleared and dimmed so that users cannot modify it.

If this registry key is set to 1, the check box is selected and dimmed so that users cannot modify it.

Outlook uses a default filter if the registry key for setting a custom check names filter is empty. The default filter used depends on two criteria:

• Is Active Directory server used?

• Is a browse list display requested or is an e-mail name queried?

If the user requests a browse list, the results include items that are not e-mail addresses, such as printers.

The following are the default filters for each scenario:

• For queries using an Active Directory server, where a user queries an e-mail name:

  (&(mail=*)(|(mail=%s*)(cn=%s*)(sn=%s*)(givenName=%s*)(displayName=%s*))

  By including the (mail=*) value, the e-mail name is required by this filter.

• For queries using an Active Directory server, where a browse list is displayed (which can include items that are not e-mail names):

  (&(|(mail=%s*)(cn=%s*)(sn=%s*)(givenName=%s*)(displayName=%s*)))

• For queries using any other server (not Active Directory), with an e-mail name query:

  (&(mail=*)(|(mail=%s*)(cn=%s*)(sn=%s*)(givenName=%s*))

• For queries using any other server (not Active Directory), with the browse list displayed:

  (&(|(mail=%s*)(cn=%s*)(sn=%s*)(givenName=%s*)))

You can provide a custom LDAP filter so that users can query additional information you provide on your LDAP server. You can define a custom filter by using an Outlook Profile (PRF) file, or you can write the custom filter string directly into the Outlook profile in the registry.

For example, you might have a CustomerID property, which is not included in the default filter. You could define the following LDAP custom filter to allow users to search on the CustomerID property:

	Copy Code
(&(mail=*)(|(mail=%s*)(displayName=%s*)(customerID=%s*)

Note:
The LDAP Request For Comments (RFC) defines the format for creating search filter strings. For more information about constructing LDAP filters, see LDAP Request For Comments (RFC).

You can also set a blank search base by creating a blank filter. This is useful when you want LDAP to use the default filter specified in the RootDSE. You create a blank filter by clearing the registry entry or by setting the CheckNames property to "" in the Outlook Profile (PRF) file.

Define a custom filter by using a PRF file

1. In a text editor (such as Notepad), open the PRF file. You can use the Office Customization Tool to create a default PRF file to edit. For more information, see Outlook in Office Customization Tool in the 2007 Office system.

2. In Section 4 (which contains the default values for each service), enter CheckNames= as a new property and type the custom search filter as the value. For example, enter the following:

   &(mail=*)(|(mail=%s*)(displayName=%s*)(customerID=%s*)

3. In Section 6 (which contains the mapping values for profile properties), define the CheckNames property. In the [LDAP Directory] section, enter the following new entry:

   CheckNames=PT_STRING8,0x6624

4. Save the file.

You can then deploy the PRF file to your users. For more information, see Apply an Outlook Profile (PRF) File to configure Outlook profiles.

You can also configure other LDAP options by using a customized PRF file. See Example: Defining LDAP options in a custom PRF file later in this topic.

Define a custom filter by using the registry

1. Start the registry editor, and then search for the registry key 001e6604.

2. Define a new LDAP search string as the registry key value, or replace the existing value.

3. Exit the registry editor.

In addition to using a custom filter for an e-mail name query, Outlook might use the same filter in a converted form for a browse list query. Outlook uses the custom filter in a converted form when the Enable Browsing check box is selected in the Search tab in the Microsoft LDAP Directory dialog box in Outlook. If you enable the browsing feature, or allow it to be enabled by users, you can help prevent search errors for users by testing the filter for both querying e-mail names and for bringing up a browse list.

When you configure custom filters, it can be helpful to know the MAPI property names that correspond to the LDAP display names.